To explain how Oracle's commercial support works, we need to first explain how the open source edition is developed.

The basic release cycle of GlassFish has
Daily,
Weekly,
Milestones
(frequency varies)
and
Final Releases.
Each Milestone is a mini-release cycle,
with its own stabilization phase at the end.

Milestone releases are quite stable, specially towards the end of the cycle,
but they are
not intended for production deployment.
Of course, since those releases are available with an Open Source license and are developed transparently,
you can make your own risk assessment
and go on production with, say, a Release Candidate milestone, but beware that
we can always discover a bad bug before final that may cause significant
changes.
In particular, Oracle only provides formal Sustaining Support for final releases.

Now we can describe the sustaining story for GlassFish.
Oracle branches a source repository from the Final GF Releases and then
we contribute fixes for important bugs with care to guarantee stability.
From there, we create regular sustaining patches that are available to
commercial subscribers (via
SunSolve initially,
soon from
My Oracle Support),
as well as the usual 24x7, worldwide support, knowledge database, etc.

To ensure that the bugs don't reappear, we also propagate the bug fixes in the sustaining
repositories into the public repositories, although the timing and details of this
will vary depending on the cycle,
and, of course, the public repositories also receive many other changes
at the same time, some of which will be new bugs :-(.
(a slightly more detailed description of this is at
Productizing Open Source - The GlassFish Approach).

Finally,
Alexis' Note
also explained how sustaining tests the bug fixes, including longevity testing, to ensure
the bug fixes are very solid.